Paperless interaction permission assignment method and system based on user group and role mapping

Abstract

The present application relates to the technical field of information security and data-driven permission management, in particular to a paperless interaction permission allocation method and system based on user group and role mapping, comprising: collecting multi-source heterogeneous data from a business system; classifying the multi-source heterogeneous data to obtain static data, semi-dynamic data and dynamic data; modeling user operation behavior based on the dynamic data to generate a de facto work cluster; integrating the static data, the semi-dynamic data and the dynamic data to construct a knowledge graph; calculating a dynamic permission health score in combination with the de facto work cluster and the knowledge graph; and constructing a permission optimization strategy based on the dynamic permission health score; the present application effectively solves the problem of permission mismatch caused by the disconnection between roles and actual work content.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security and data-driven permission management, in particular to a paperless interaction permission allocation method and system based on user group and role mapping. BACKGROUND

[0002] In enterprise information management, permission allocation is usually based on static and coarse-grained role definition. Technical personnel pre-set fixed permission templates for different posts or departments, and then users are classified into corresponding roles to complete authorization.

[0003] However, this method is difficult to adapt to the dynamic changes of users in actual business. With the evolution of business processes and the adjustment of personnel responsibilities, the pre-set static roles often do not match the actual operation needs of users, resulting in redundant permissions or permission loss. Redundant permissions may lead to data leakage and misuse of permissions, while permission loss may cause business interruption, posing potential security risks. In addition, traditional permission management relies on passive manual audit, which is slow in response and difficult to actively and timely identify and eliminate these risks. Therefore, how to realize dynamic and intelligent allocation of permissions to accurately match the actual work needs of users and actively prevent and resolve related security risks has become a technical problem to be solved in the field. SUMMARY

[0004] The purpose of the present application is to provide a paperless interaction permission allocation method and system, which aims to solve the problem of mismatch between permission configuration and actual business needs of users caused by relying on static and coarse-grained role definition, so as to actively identify and eliminate potential security risks such as data leakage, misuse of permissions or business interruption caused by redundant permissions or permission loss, and realize continuous monitoring and active optimization of user permission configuration. Specifically, the technical scheme of the present application comprises:

[0005] A paperless interaction permission allocation method, comprising the following steps:

[0006] Step S1: Collecting multi-source heterogeneous data from a business system;

[0007] Step S2: Classifying the multi-source heterogeneous data to obtain static data, semi-dynamic data and dynamic data;

[0008] Step S3: Modeling user operation behavior based on the dynamic data to generate a de facto work cluster;

[0009] Step S4: Integrating the static data, semi-dynamic data and dynamic data to build a knowledge graph;

[0010] Step S5: Calculate a dynamic permission health score in combination with the de facto work cluster and the knowledge graph;

[0011] Step S6: Construct a permission optimization strategy based on the dynamic permission health score.

[0012] Preferably, the step of calculating the dynamic permission health score specifically comprises:

[0013] Step S51: Query the static data to determine an assigned permission set;

[0014] Step S52: In combination with the de facto work cluster to which the user belongs and the business context of the user in the knowledge graph, infer an actual required permission set;

[0015] Step S53: Compare the assigned permission set with the actual required permission set to identify a redundant permission set;

[0016] Step S54: Compare the assigned permission set with the actual required permission set to identify a missing permission set;

[0017] Step S55: Based on the redundant permission set and the missing permission set, generate the dynamic permission health score.

[0018] Preferably, the method further comprises:

[0019] Based on the redundant permission set, a preset permission sensitivity weight, and a permission usage frequency factor, calculate an original permission redundancy risk index;

[0020] Based on the missing permission set, a preset business importance weight, and a permission missing operation failure factor, calculate an original permission missing degree risk index.

[0021] Preferably, the step of generating the dynamic permission health score specifically comprises:

[0022] Using a preset nonlinear normalization function to standardize the original permission redundancy risk index to generate a redundancy standardization risk score;

[0023] Using the nonlinear normalization function to standardize the original permission missing degree risk index to generate a missing degree standardization risk score;

[0024] Weighted sum the redundancy standardization risk score and the missing degree standardization risk score to obtain a comprehensive risk deduction term;

[0025] Subtract the comprehensive risk deduction term from a preset ideal health state score to generate the dynamic permission health score.

[0026] Preferably, the step of constructing the permission optimization strategy specifically comprises:

[0027] When the dynamic permission health score is lower than a preset risk threshold, a risk warning is generated and a permission adjustment suggestion is generated;

[0028] When the dynamic permission health score is not lower than the preset risk threshold, the current permission configuration is maintained.

[0029] Preferably, the method further comprises:

[0030] According to a preset automatic policy, the permission adjustment suggestion is automatically executed.

[0031] Preferably, the step of modeling the user operation behavior is specifically:

[0032] Feature engineering is performed on the dynamic data, and the log data of each user is converted into a multi-dimensional behavior vector;

[0033] A clustering algorithm is used to perform clustering analysis on the multi-dimensional behavior vectors of all users to generate the de facto work cluster.

[0034] A paperless interaction permission allocation system comprises:

[0035] A data acquisition module is configured to acquire multi-source heterogeneous data from a business system;

[0036] A data classification module is configured to classify the multi-source heterogeneous data to obtain static data, semi-dynamic data and dynamic data;

[0037] A user behavior modeling module is configured to model user operation behavior based on the dynamic data and generate a de facto work cluster;

[0038] A knowledge graph construction module is configured to integrate the static data, the semi-dynamic data and the dynamic data and construct a knowledge graph;

[0039] A permission health score calculation module is configured to calculate a dynamic permission health score in combination with the de facto work cluster and the knowledge graph;

[0040] A permission optimization strategy module is configured to construct a permission optimization strategy based on the dynamic permission health score.

[0041] Compared with the prior art, the present application has the following advantages:

[0042] 1.The present application can surpass static and preset role definition by modeling the actual operation behavior of users and constructing a knowledge graph combined with business context, dynamically inferring the required permissions according to the real work mode of users, ensuring that the permission allocation accurately matches the actual business needs of users, and effectively solving the problem of permission mismatch caused by the disconnection between roles and actual work content;

[0043] 2.The present application establishes a proactive and quantitative risk assessment system, converts the rationality and safety of permission configuration into intuitive and measurable scores through dynamic calculation of permission health score, and actively identifies and quantifies the potential security risks and business interruption risks caused by permission redundancy or lack, transforming passive manual audit into proactive and data-driven risk monitoring;

[0044] 3.The present application realizes the intelligent and automated closed loop of permission management, when identifying the risk of permission configuration, the system can not only automatically alarm, but also generate specific and executable permission adjustment suggestions, and for high confidence suggestions, the system can automatically execute optimization operations, thereby freeing administrators from tedious manual configuration and audit, realizing the continuous convergence and self-repair of permission risk;

[0045] 4.The present application significantly improves the balance between information security and business agility, actively eliminates the potential risks of data leakage and permission abuse by accurately identifying and suggesting the removal of redundant permissions, and effectively avoids business process interruption by timely discovering and suggesting the filling of missing permissions, ensuring the efficient and agile operation of business, and achieving an ideal balance between security and convenience. BRIEF DESCRIPTION OF DRAWINGS

[0046] The present application will be further explained in conjunction with the accompanying drawings and embodiments:

[0047] Figure 1 is a flowchart of the method of the present application;

[0048] Figure 2 is a structural diagram of the system of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the present application clearer and more apparent, the present application will be further described in detail in conjunction with specific embodiments.

[0050] Embodiment 1:

[0051] Please refer to Figure 1 A paperless interaction permission allocation method, comprising the following steps:

[0052] Step S1: Collecting multi-source heterogeneous data from a business system;

[0053] Step S2: classifying the multi-source heterogeneous data to obtain static data, semi-dynamic data and dynamic data;

[0054] Step S3: modeling user operation behavior based on the dynamic data to generate a de facto work cluster;

[0055] Step S4: integrating the static data, the semi-dynamic data and the dynamic data to construct a knowledge graph;

[0056] Step S5: combining the de facto work cluster and the knowledge graph to calculate a dynamic permission health score;

[0057] Step S6: constructing a permission optimization strategy based on the dynamic permission health score.

[0058] The application provides a paperless interaction permission allocation method, aiming to solve the problem of mismatch between permission configuration and actual business needs of users caused by dependence on static and coarse-grained role definition in the prior art, thereby actively identifying and eliminating potential security risks, and the method constitutes a complete data-driven, dynamic evaluation and intelligent optimization technical closed loop;

[0059] Multi-source heterogeneous data is collected from a business system; this step aims to build a comprehensive and multi-dimensional data foundation for all subsequent analysis steps; in this embodiment, the data collection module of the system collects multi-source heterogeneous data from the human resource system, the permission management center, the project management platform and the application server of the paperless interaction platform itself and other business systems of the enterprise in real time or at a preset period through application program interfaces, database direct connection or log file pulling;

[0060] The multi-source heterogeneous data is classified to obtain static data, semi-dynamic data and dynamic data; this step aims to structurally preprocess the original data, divide it according to its change frequency and business attributes, so that subsequent modules can be processed accordingly; in this embodiment, the classification rules are defined as follows:

[0061] The static data represents the basic organizational structure and permission definition data with extremely low change frequency, and its role is to provide a benchmark and basis for permission allocation, and its source is the user-department-position mapping table in the human resource system and the role-permission definition table in the permission system;

[0062] The semi-dynamic data represents data related to a specific project or process lifecycle with moderate change frequency, and its role is to provide temporary and task-related business context, and its source is the project member list, task assignment record in the project management system and process instance data in the workflow engine;

[0063] The dynamic data for characterization refers to the user actual operation behavior log generated at high frequency, and the role is to truly reflect the working mode of the user in the system, and the source is the application layer log of the paperless interaction platform, which records the user identity, timestamp, operation type, operation object and operation result and other information in detail;

[0064] Modeling the user operation behavior based on the dynamic data generates the actual working cluster, and the innovation purpose of this step is to surpass the nominal organization department or post division, and to mine the functionally similar user group from the actual behavior data, and the actual working cluster refers to a user set with highly similar operation behavior mode in the system identified by a non-supervised learning algorithm, and the role is to provide the core behavior basis for inferring the actual required permission of the user, and the source is the clustering analysis result of the dynamic data ;

[0065] Integrating the static data, the semi-dynamic data and the dynamic data constructs the knowledge graph, and this step aims to connect the isolated data points into a relationship network rich in business semantics, so that the system can understand the complete business background behind a permission operation, and the knowledge graph in the present application refers to a graph structured database composed of entity nodes and relationship edges, and the role is to provide the associated basis of the business context for accurately inferring the actual required permission of the user, and in the present embodiment, the entity nodes of the graph include users, departments, projects, tasks, data objects and the like, and the relationship edges represent the relationship between them, such as user affiliation to department, user participation in project, user operation on data object and the like. The knowledge graph is constructed by integrating the information of , and ;

[0066] In combination with the actual working cluster and the knowledge graph, the dynamic permission health score is calculated, which is the core quantitative evaluation link of the present application, and aims to convert the rationality and safety of a user permission configuration into an intuitive and measurable score. The dynamic permission health score is a comprehensive evaluation score between 0 and 100, and the role is to macroscopically measure the risk state of the current permission configuration, and the lower the score, the higher the risk. The score is obtained by quantitatively calculating the redundancy and lack of risk of the permission after comprehensively considering the actual working content revealed by the actual working cluster to which the user belongs and the business context provided by the knowledge graph;

[0067] Based on the dynamic permission health score, a permission optimization strategy is constructed, which aims to convert the quantitative risk assessment results into specific and executable improvement actions, realize the closed-loop management from risk identification to risk disposal, and the permission optimization strategy refers to a series of preset response mechanisms triggered automatically according to the dynamic permission health score, which is used to actively and timely correct the permission mismatch problem;

[0068] Through the above steps, the present application constructs a complete process from data acquisition, behavior modeling, context construction to risk quantitative evaluation and intelligent intervention, which changes the focus of permission management from the traditional and static configuration efficiency to the data-driven and dynamic allocation result risk level as the core, realizes the continuous monitoring and active optimization of user permission configuration, and compared with the prior art, the present method can effectively bridge the semantic gap between the static organization role and the dynamic actual demand of the user, actively prevents the data leakage, permission abuse or business interruption risk caused by ghost permission or permission loss, and thus achieves a significant technical balance between guaranteeing information security and improving business agility.

[0069] For the new employees or users with insufficient activity records, i.e. the cold start problem, the present method further includes an initialization processing step, when it is detected that the dynamic data of the user is insufficient, the system will not use the behavior-based modeling, but will degenerate into a role-based enhancement mode, specifically, the system will mainly rely on the static data such as the department, position and semi-dynamic data such as the projects participated by the user, find the template user or role portrait most similar to the role of the user in the knowledge graph, and take the actual required permission set of the template user or role portrait as the temporary inference result of the new user. At the same time, the system will assign a default and low health score, for example, 75 points, to such a user, and mark it as an observation period, until sufficient behavior data is collected, which ensures that the model can give reasonable output under all input values, and guarantees its robustness.

[0070] Embodiment 2:

[0071] The step of calculating the dynamic permission health score is specifically:

[0072] Step S51: querying the static data to determine the allocated permission set;

[0073] Step S52: combining the actual working cluster to which the user belongs and the business context of the user in the knowledge graph to infer the actual required permission set;

[0074] Step S53: comparing the allocated permission set with the actual required permission set to identify the redundant permission set;

[0075] Step S54: Compare the allocated permission set with the actual required permission set to identify the missing permission set;

[0076] Step S55: Generate the dynamic permission health score based on the redundant permission set and the missing permission set.

[0077] This embodiment, based on the method described in Example 1, specifies the steps for calculating the dynamic permission health score. Its purpose is to clearly define the source of permission risk, namely the difference between the allocated permissions and the actual requirements, and to provide a basis for subsequent risk quantification.

[0078] By querying the static data, the assigned permission set is determined; this step aims to obtain a static baseline of user permission configurations. Assigned permission set , refers to based on static data The query result is currently explicitly granted to a specific user. The set of all permissions;

[0079] Combining the user's actual work cluster with the user's business context in the knowledge graph, the actual required set of permissions is inferred; this step is one of the core innovations of this invention, aiming to dynamically infer the minimum set of permissions necessary for a user to complete their actual work through an algorithm, and the actual required set of permissions. This is a core custom concept of the present invention. It is not statically assigned, but dynamically deduced through rigorous algorithmic logic. In this embodiment, it identifies the user. The actual working cluster to which it belongs In knowledge graphs Inquiry and User The currently directly associated business entity will use this work cluster. The permissions commonly used by other members to complete similar business tasks, and the user The inference result is obtained by intersecting the permissions directly related to its own business context. This dual constraint ensures the rigor and accuracy of the inference.

[0080] Commonly used permissions refer to permissions within the working cluster. In the knowledge graph, the set of permissions that have been used at least once by more than 80% of members during the evaluation period, and permissions directly associated with their own business context, refer to the permissions in the knowledge graph. In the middle, with users The set of permission nodes that are directly connected to the project node or the task node under one's responsibility and point to the permission relationship edge is used to ensure that the inference result is both consistent with the group behavior pattern and highly relevant to the individual's current task by taking the intersection of these two sets.

[0081] comparing the assigned permission set with the actual required permission set to identify a redundant permission set. This step aims to quantify the degree of deviation from the principle of least privilege, the redundant permission set referring to the set of permissions that the user is granted but does not actually need in the actual work, obtained by set subtraction operation

[0082] Meanwhile, comparing the assigned permission set with the actual required permission set to identify a missing permission set. This step aims to quantify the degree of hindrance to business efficiency caused by the permission configuration. The missing permission set refers to the set of permissions that the user needs according to the user behavior and business context, but is not currently assigned, obtained by set subtraction operation

[0083] Based on the redundant permission set and the missing permission set, a dynamic permission health score is generated. This step aims to integrate the permission differences in the above two dimensions into a single, comprehensive health evaluation index. The system will calculate the original risk index based on the two difference sets, then perform standardization and weighted summation, and finally deduct from an ideal score to generate a dynamic permission health score.

[0084] Compared with only generally calculating the health score, the present embodiment clearly defines and distinguishes the assigned permission set and the actual required permission set, and identifies the redundant permission set and the missing permission set on this basis, providing two orthogonal and clear analysis dimensions for the assessment of permission risk. This specificization makes the source of risk traceable and interpretable, not only improving the accuracy and transparency of the health score calculation, but also laying a solid foundation for subsequent generation of accurate and targeted optimization suggestions.

[0085] Example 3:

[0086] The method further comprises:

[0087] Based on the redundant permission set, the preset permission sensitivity weight and the permission usage frequency factor, an original permission redundancy risk index is calculated.

[0088] Based on the missing permission set, the preset business importance weight and the permission missing operation failure factor, an original permission missing degree risk index is calculated.

[0089] The present embodiment further specifies the initial quantification process of risk on the basis of the method described in Example 2, aiming to convert the identified redundant and missing permission sets into original risk indexes with business and security implications. The present embodiment further comprises:

[0090] ​​Based on the redundant permission set, the preset permission sensitivity weight and the permission use frequency factor, an original permission redundancy risk index is calculated; the calculation aims to quantify the potential security risks brought by the ghost permissions held by the user, and the original permission redundancy risk index is calculated by the following formula:

[0091] ;

[0092] wherein, : This is the redundant permission set identified in Example 2, which is the traversal range of the summation;

[0093] : Permission sensitivity weight, which refers to a dimensionless weight value preset according to the potential destructiveness of the permission , which is used to make high-risk permissions have a higher proportion in the risk calculation, and which is derived from the enterprise's internal security policy and expert knowledge base, and in the present embodiment, the value range is ;

[0094] : Permission use frequency factor, which refers to the normalized representation of the user's use frequency of the permission in the past evaluation period, which is a dimensionless value between , and which is used to impose a higher risk penalty on redundant permissions that have not been used for a long time, and which is obtained by statistical analysis of dynamic data ; in the present embodiment, the calculation formula of is:

[0095] ;

[0096] wherein, is the number of times the user uses the permission in the evaluation period, is the number of times the user uses the most frequently used permission. Log transformation is used to smooth the impact of high-frequency use;

[0097] Based on the missing permission set, the preset business importance weight and the permission missing operation failure factor, an original permission missing degree risk index is calculated; the calculation aims to quantify the business interruption risk and efficiency loss caused by the user's lack of necessary permissions, and the original permission missing degree risk index is calculated by the following formula:

[0098] ;

[0099] wherein, : The set of missing permissions identified in Example 2, as the range of summation;

[0100] : Business importance weight, refers to a dimensionless weight value preset according to the importance of a critical business process, which is used to make the permission missing problem affecting the core business have a higher proportion in the risk calculation, and the source is the business process analysis result of the business department of the enterprise, and in the present embodiment, the value range is ;

[0101] : Permission missing operation failure factor, refers to the normalized representation of the frequency of user operation failure due to lack of permissions in the evaluation period, which is a dimensionless value between 0 and 1, and its role is to quantify the specific impact of permission missing on actual work, and the source is the deep analysis of the logs of operation results as failure or permission rejection in dynamic data ; In the present embodiment, the calculation formula of is as follows:

[0102] ;

[0103] Wherein, is the number of times that the user fails to use the missing permission to cause the operation to fail, and is the total number of attempts of the related operation that the user needs permission for. This formula calculates the proportion of failed operations in all related attempts;

[0104] The innovation of the present embodiment is that it does not simply count redundant or missing permissions, but introduces four key, business and security semantic adjustment factors. This makes the risk assessment no longer a rough statistics, but a fine, closely integrated with business scenarios Quantification process. For example, a high-sensitivity and long-term unused redundant permission will produce much higher risk index than a low-sensitivity and occasionally used redundant permission, and this design greatly improves the accuracy and business relevance of risk assessment;

[0105] ​Considering the subjectivity and lag of manual setting of the permission sensitivity weight and the business importance weight, another preferred embodiment of the method further includes a weight self-adaptation module. The module analyzes the connection tightness of the permission nodes and special nodes such as core business processes and sensitive data in the knowledge graph, analyzes historical security event logs related to permissions, and automatically recommends or dynamically adjusts the sensitivity and importance weights of the permissions by using a graph algorithm or a machine learning model, thereby reducing the dependence on manual configuration and improving the objectivity and timeliness of the weights.

[0106] To further improve the comprehensiveness of risk assessment, an advanced embodiment of the application also considers the synergistic risk between permissions. The system pre-defines a high-risk permission combination rule library, for example, the combination of database administrators and financial auditors is marked as a high-risk combination. When calculating the original permission redundancy risk index, in addition to summing up the individual redundant permissions, the system also detects whether there is a combination that meets the rule library in the user's redundant permission set. Once a hit is made, an additional significant penalty term is added to the final risk index , thereby more accurately reflecting the security threats brought by permission combinations.

[0107] Embodiment 4:

[0108] The steps of generating the dynamic permission health score are as follows:

[0109] The original permission redundancy risk index is standardized by using a preset nonlinear normalization function to generate a redundancy standardized risk score.

[0110] The original permission redundancy risk index is standardized by using a preset nonlinear normalization function to generate a redundancy standardized risk score.

[0111] The redundancy standardized risk score and the missing degree standardized risk score are weighted and summed to obtain a comprehensive risk deduction term.

[0112] The comprehensive risk deduction term is subtracted from the preset ideal health state score to generate the dynamic permission health score.

[0113] Based on the method described in Embodiment 3, the steps of generating the dynamic permission health score are finally mathematically constructed to convert two independent, unbounded original risk indexes into a unified, bounded, and intuitive health score. The steps are as follows:

[0114] The original authority redundancy risk index is standardized by using a preset nonlinear normalization function to generate a redundancy standardized risk score. This step aims to solve the problem that the original risk index is an unbounded cumulative value, leading to the risk between different users being incomparable, and the health degree evaluation granularity being rough. In this embodiment, the nonlinear normalization function used is a function that can respond linearly to low risk values and saturate high risk values. The mathematical form is as follows:

[0115] ;

[0116] wherein, is the original authority redundancy risk index calculated in Example 3;

[0117] is the redundancy standardized risk score generated after processing, whose value range is mapped to interval;

[0118] is a risk sensitivity adjustment coefficient, which is a positive dimensionless hyperparameter that controls the speed of risk score growth with the original risk index. To clarify the calibration process, it is necessary to distinguish between the variables in the calibration dataset and the input variables during model operation. In this embodiment, the value of k is determined based on a calibration dataset containing N groups of historical cases , wherein the new symbol represents the original risk index of the th historical case, and the new symbol represents the target risk score given by the safety expert based on the actual harm degree of the case, is the total number of historical cases in the calibration dataset. The value of parameter k is obtained by solving an optimization problem, that is, finding the optimal k to minimize the error between the predicted value and the expert score, for example, minimizing the mean square error ;

[0119] The original authority redundancy risk index is standardized by using a preset nonlinear normalization function to generate a redundancy standardized risk score. This step aims to solve the problem that the original risk index is an unbounded cumulative value, leading to the risk between different users being incomparable, and the health degree evaluation granularity being rough. In this embodiment, the nonlinear normalization function used is a function that can respond linearly to low risk values and saturate high risk values. The mathematical form is as follows:

[0120] ;

[0121] wherein is the redundancy standardized risk score generated after processing;

[0122] The redundancy standardized risk score and the missing degree standardized risk score are weighted and summed to obtain a comprehensive risk deduction item, which aims to balance and integrate security risks and business efficiency risks according to the risk preference of the enterprise, and the calculation method of the comprehensive risk deduction item is: ;

[0123] Wherein: : are the permission redundancy risk penalty coefficient and the permission missing degree risk penalty coefficient, respectively, which are dimensionless hyperparameters, and their sum is 1, and their function is to reflect the emphasis of the enterprise on different types of risks, and their source is the overall risk preference strategy of the enterprise;

[0124] Subtract the comprehensive risk deduction item from the preset ideal health state score to generate the dynamic permission health degree score; this step finally obtains a single and intuitive evaluation result, and in the embodiment, the ideal health state score is preset to 100 points, and the final dynamic permission health degree score is generated by the following formula:

[0125] ;

[0126] The embodiment ingeniously solves the technical problems of poor comparability of original risk values and insufficient evaluation granularity by introducing a nonlinear normalization function, and more importantly, by introducing adjustable penalty coefficients and , the technical solution of the present application has high flexibility and adaptability, and can be customized and adjusted according to the specific risk preference of different organizations, and the finally generated single health degree score greatly reduces the cognitive load of the administrator, so that he can quickly focus on the most serious problems of the user.

[0127] Example 5:

[0128] The steps of constructing the permission optimization strategy are specifically:

[0129] When the dynamic permission health degree score is lower than the preset risk threshold, a risk warning is generated and a permission adjustment suggestion is generated;

[0130] When the dynamic permission health degree score is not lower than the preset risk threshold, the current permission configuration is maintained.

[0131] The embodiment on the basis of the method described in Example 1, the steps of constructing the permission optimization strategy are specified, which aims to convert the calculated quantitative risk evaluation result into an executable and clearly directed intervention action;

[0132] When the dynamic permission health score is lower than the preset risk threshold, a risk warning is generated and a permission adjustment suggestion is generated. This step aims to achieve proactive risk warning and intelligent assisted decision-making.

[0133] Risk threshold This is a pre-defined health score threshold, used to distinguish between acceptable and unacceptable risks. In this embodiment, this threshold is determined through statistical analysis of the health scores of user samples who have experienced security incidents or severe business interruptions in historical datasets. For example, it can be set as the 80th percentile of the sample score distribution. point;

[0134] When a user When this happens, the system will mark the user as high-risk on the risk monitoring dashboard and send a risk warning to the system administrator through preset channels;

[0135] At the same time, the system will further drill down to analyze the specific risk items that constitute low scores and generate permission adjustment suggestions. For example, if it is determined that the low scores are mainly caused by high values... This will cause the system to locate the target. The most redundant permissions It also generates a suggestion to remove database delete permissions for user u, with the reason being that this permission is highly sensitive and such human-readable suggestions have not been used recently.

[0136] When the dynamic permission health score is not lower than the preset risk threshold, the current permission configuration is maintained. This step aims to avoid unnecessary system disturbances and ensure the stability of the permission configuration. When the system determines that the user's permission configuration is in a healthy or acceptable state, no intervention will be performed.

[0137] This implementation method, by introducing risk thresholds and an automated suggestion generation mechanism, transforms complex risk data into simple and clear action instructions, greatly reducing the threshold for access control and the workload of administrators. It transforms the passive access control model that relies on manual auditing into a proactive, data-driven model of continuous monitoring, risk warning, and intelligent suggestions, significantly improving the speed and accuracy of risk response.

[0138] Example 6:

[0139] This method also includes:

[0140] The permission adjustment suggestions are automatically executed according to the preset automation strategy.

[0141] The embodiment further increases an automatic execution link based on the method described in Embodiment 5, aiming to realize closed-loop optimization without human intervention for some high-confidence permission adjustment suggestions, thereby maximizing operational efficiency and ensuring continuous risk convergence.

[0142] According to a preset automatic strategy, the permission adjustment suggestion is automatically executed.

[0143] The preset automatic strategy refers to a set of rules pre-configured by an administrator for defining which types of permission adjustment suggestions can be automatically executed by the system without manual approval. In the embodiment, the automatic strategy can be configured as:

[0144] High-confidence removal rule: if a permission adjustment suggestion is to remove a permission, and the permission meets the permission sensitivity weight , the permission usage frequency factor in the past 180 days and the permission does not belong to any mandatory permission in the user static role definition, the system automatically executes the removal operation;

[0145] Low-risk grant rule: if a permission adjustment suggestion is to grant a permission, and the permission meets the business importance weight , the permission missing operation failure factor in the past 30 days and more than 90% of the members in the actual working cluster of the user have this permission, the system can automatically grant the permission;

[0146] For suggestions that do not meet the automatic strategy, the system will still follow the process of Embodiment 5, only generating suggestions and waiting for manual approval by the administrator;

[0147] The embodiment introduces a selective automatic execution mechanism, bringing the ability of autonomous driving to permission management. It can realize continuous and automatic optimization of permission configuration under the premise of ensuring safety, especially when dealing with a large number of explicit ghost permissions. It can greatly liberate the human resources of the IT support department, enabling the entire permission ecosystem to have the ability of self-repair and self-optimization.

[0148] Embodiment 7:

[0149] The step of modeling user operation behavior is specifically:

[0150] Feature engineering is performed on the dynamic data to convert the log data of each user into a multi-dimensional behavior vector.

[0151] A clustering algorithm is used to perform clustering analysis on the multi-dimensional behavior vectors of all users to generate the actual working clusters.

[0152] The embodiment describes the specific technical implementation of the step of modeling user operation behavior based on the method described in Embodiment 1, aiming to reveal how to extract the actual work cluster that can represent the actual work content of the user from the original and unstructured log data;

[0153] The dynamic data is subjected to feature engineering to convert the log data of each user into a multi-dimensional behavior vector. This step aims to quantify and structure the behavior log of the user so that it can be processed by a machine learning algorithm. In this embodiment, the system extracts original features related to the user behavior pattern from the dynamic data , such as operation type, operation object type, operation time distribution, operation frequency, etc. Based on these features, the system aggregates all logs of each user in an evaluation period to convert the above features into a numerical multi-dimensional behavior vector ;

[0154] In this embodiment, the conversion process is as follows: for a pre-defined operation type list such as login, query, edit, delete, etc., the frequency of each operation is counted; for the operation object type, the bag-of-words model is used to count the occurrence distribution; for the operation time, the day is divided into 24 time slots, and the number of operations in each time slot is counted. Finally, these numerical statistical results are concatenated to form the final multi-dimensional behavior vector ;

[0155] A clustering algorithm is used to perform clustering analysis on the multi-dimensional behavior vectors of all users to generate the actual work cluster. This step aims to automatically classify users with similar behavior patterns into a category in the behavior vector space. In this embodiment, a density-based clustering algorithm such as DBSCAN is selected. DBSCAN algorithm divides all users into a series of high-density regions according to the density distribution of the behavior vector, and each region constitutes an actual work cluster . The final output is a set of work clusters ;

[0156] This embodiment realizes a bottom-up user group discovery mechanism starting from the underlying data by introducing feature engineering and clustering algorithm. Unlike the existing technology which relies on static and pre-defined artificial roles, the actual work cluster generated by this method can reveal the implicit work roles and collaboration patterns that actually exist but are not explicitly defined within the organization, thereby greatly improving the accuracy and practical relevance of the actual required permission set inference.

[0157] Embodiment 8:

[0158] Please refer to Figure 2A paperless interaction permission allocation system comprises:

[0159] A data collection module is configured to collect multi-source heterogeneous data from a business system.

[0160] A data classification module is configured to classify the multi-source heterogeneous data to obtain static data, semi-dynamic data and dynamic data.

[0161] A user behavior modeling module is configured to model user operation behavior based on the dynamic data to generate a de facto work cluster.

[0162] A knowledge graph construction module is configured to integrate the static data, the semi-dynamic data and the dynamic data to construct a knowledge graph.

[0163] A permission health degree calculation module is configured to calculate a dynamic permission health degree score in combination with the de facto work cluster and the knowledge graph.

[0164] A permission optimization strategy module is configured to construct a permission optimization strategy based on the dynamic permission health degree score.

[0165] The application further provides a paperless interaction permission allocation system, which is a hardware and software carrier of the above method, the internal modules of which are divided one by one corresponding to the steps of the method, and the modules are tightly coupled through data flow and work cooperatively.

[0166] A data collection module is configured to perform the data collection step in the above method, and is internally configured as a set of pluggable data connectors corresponding to different business systems to collect multi-source heterogeneous data from the business systems.

[0167] A data classification module is configured to perform the data classification step in the above method, and is technically implemented as a data preprocessing engine to classify the collected raw data stream according to preset rules to obtain static data, semi-dynamic data and dynamic data.

[0168] A user behavior modeling module is configured to perform the user behavior modeling step in the above method, and the core of the module is an analysis engine integrated with a machine learning algorithm to model user operation behavior based on dynamic data to generate a de facto work cluster.

[0169] A knowledge graph construction module is configured to perform the knowledge graph construction step in the above method, and the implementation mode of the module is a graph database and a construction program thereof to integrate all types of data to construct a knowledge graph.

[0170] A permission health degree calculation module is configured to perform the health degree calculation step in the above method, and the module serves as a core calculation engine of the system to calculate a dynamic permission health degree score in combination with the de facto work cluster and the knowledge graph.

[0171] The permission optimization strategy module is used for performing the permission optimization strategy construction step in the foregoing method, and is a strategy and alarm engine in function. The permission optimization strategy is constructed based on the dynamic permission health score, and includes generating a risk early warning, generating an adjustment suggestion, or performing an automatic operation;

[0172] The system clearly maps the complex method process into functionally independent system components through modular design, and constitutes an efficient and orderly data processing and decision pipeline. This architecture not only makes the implementation and maintenance of the system more convenient, but also ensures that the entire permission allocation method can be stably operated as a complete and self-consistent automatic system, thereby converting the technical concept of the application into an industrial-level solution that can be implemented and deployed.

[0173] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit it. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application.

Claims

1. A paperless interactive permission assignment method, characterized by, Comprise the following steps: Step S1: Collecting multi-source heterogeneous data from business systems; Step S2: Classifying the multi-source heterogeneous data to obtain static data, semi-dynamic data and dynamic data; Static data refers to basic organizational structure and permission definition data with extremely low change frequency, which provides the basis for permission allocation, and its source is the user-department-position mapping table in the human resource system and the role-permission definition table in the permission system; Semi-dynamic data refers to data related to specific projects or process life cycles with moderate change frequency, which provides temporary and task-related business context, and its source is the project member list, task assignment record in the project management system, and process instance data in the workflow engine; Dynamic data refers to high-frequency user actual operation behavior logs, which truly reflect user work patterns in the system, and its source is the application layer log of the paperless interaction platform, which records user identity, timestamp, operation type, operation object and operation result in detail; Step S3: Modeling user operation behavior based on the dynamic data to generate a de facto work cluster; Step S4: Integrating the static data, semi-dynamic data and dynamic data to build a knowledge graph; Step S5: Calculating the dynamic permission health score in combination with the de facto work cluster and the knowledge graph; Step S6: Building a permission optimization strategy based on the dynamic permission health score; The step of calculating the dynamic permission health score specifically comprises: Step S51: Querying the static data to determine the allocated permission set; Step S52: Combining the de facto work cluster to which the user belongs and the business context of the user in the knowledge graph to infer the actual required permission set; Step S53: Comparing the allocated permission set with the actual required permission set to identify the redundant permission set; Step S54: Comparing the allocated permission set with the actual required permission set to identify the missing permission set; Step S55: Generating the dynamic permission health score based on the redundant permission set and the missing permission set.

2. The paperless interactive permission assignment method of claim 1, wherein, Also includes: Based on the redundant permission set, the preset permission sensitivity weight and the permission usage frequency factor, calculate the original permission redundancy risk index; Based on the missing permission set, the preset business importance weight and the permission missing operation failure factor, calculate the original permission missing degree risk index.

3. The paperless interactive permission assignment method of claim 2, wherein, The step of generating the dynamic permission health score specifically comprises: Using a preset nonlinear normalization function to standardize the original permission redundancy risk index to generate a redundancy standardization risk score; Using the nonlinear normalization function to standardize the original permission missing degree risk index to generate a missing degree standardization risk score; Weighted sum of the redundancy standardization risk score and the missing degree standardization risk score to get a comprehensive risk deduction term; Subtract the comprehensive risk deduction term from the preset ideal health state score to generate the dynamic permission health score.

4. The paperless interactive permission assignment method of claim 1, wherein, The step of building a permission optimization strategy specifically comprises: When the dynamic permission health score is lower than a preset risk threshold, a risk warning is generated and a permission adjustment suggestion is generated; When the dynamic permission health score is not lower than the preset risk threshold, the current permission configuration is maintained.

5. The paperless interactive rights allocation method of claim 4, wherein, Further comprising: According to a preset automation strategy, the permission adjustment suggestion is automatically executed.

6. The paperless interactive rights allocation method of claim 1, wherein, The step of modeling the user operation behavior is specifically: Feature engineering is performed on the dynamic data, and the log data of each user is converted into a multi-dimensional behavior vector; A clustering algorithm is used to perform clustering analysis on the multi-dimensional behavior vectors of all users to generate the de facto work cluster.

7. A paperless interactive rights allocation system for carrying out the paperless interactive rights allocation method of any one of claims 1 to 6, characterized by Comprise: A data collection module for collecting multi-source heterogeneous data from a business system; A data classification module for classifying the multi-source heterogeneous data to obtain static data, semi-dynamic data and dynamic data; A user behavior modeling module for modeling user operation behavior based on the dynamic data to generate a de facto work cluster; A knowledge graph construction module for integrating the static data, the semi-dynamic data and the dynamic data to construct a knowledge graph; A permission health score calculation module for calculating a dynamic permission health score in combination with the de facto work cluster and the knowledge graph; A permission optimization strategy module for constructing a permission optimization strategy based on the dynamic permission health score.

Images